moved auth stuff out into seperate module